DHA, DOH or MOHAP? The UAE clinic IT compliance map, emirate by emirate

Short answer: a UAE clinic's IT obligations follow its licensing authority. Dubai clinics are licensed by the DHA and connect to NABIDH and eClaimLink. Abu Dhabi clinics are licensed by the DOH and connect to Malaffi and Shafafiya. Clinics in the Northern Emirates fall under MOHAP and connect to Riayati. Your clinic software for UAE compliance has to speak the right mix.

We get this question in almost every first meeting with a clinic group that is expanding from one emirate into another. The rules are public, but they are spread across three regulators, several portals and a long list of circulars. This guide puts them side by side so owners, practice managers and IT leads can see what changes when they cross an emirate border.

This article is general guidance, not legal advice. Regulators update their standards, circulars and deadlines often, so always confirm the current requirement with the relevant authority or a qualified advisor before you act on it.

Three regulators, three rails

Health regulation in the UAE is split between federal and emirate-level bodies. The Ministry of Health and Prevention (MOHAP) is the federal regulator. Dubai and Abu Dhabi each have their own health authority. A licence from one does not let you operate a facility in another, and the same is true of the digital systems each authority requires.

Two edge cases catch people out. Dubai Healthcare City has its own regulator, so a DHCC clinic should confirm which rules apply to it rather than assume DHA's. And Sharjah has the Sharjah Health Authority alongside MOHAP, so a Sharjah facility should check which body licenses it before planning integrations.

Dubai: DHA, NABIDH and eClaimLink

NABIDH (National Backbone for Integrated Dubai Health) is the DHA's health information exchange. It connects public and private facilities so a doctor can see a patient's history from other providers. DHA publishes the interoperability standards and an HL7 v2.5.1 inbound specification that clinic systems must follow. In practice, connecting to NABIDH is tied to facility licensing, so treat it as a condition of operating, not an optional upgrade.

Insurance runs on a separate rail. eClaimLink is Dubai's e-claims standard, and DHPO (the Dubai Health Post Office) is the gateway that moves claims, prior authorization requests, eRx transactions and remittance advice between providers and payers. Many people use the two names interchangeably. Our NABIDH integration guide covers the clinical side in detail.

Abu Dhabi: DOH, Malaffi and Shafafiya

Malaffi is Abu Dhabi's health information exchange, a DOH initiative run by Abu Dhabi Health Data Services. Malaffi states that all DOH-licensed facilities must connect unless they fall into an exempt category (military, police, aviation, universities and others Malaffi identifies). It also states that non-exempt facilities that have not connected cannot renew their DOH licence, and that facilities with Daman agreements cannot submit claims to Daman until they connect.

Claims in Abu Dhabi go through Shafafiya, the DOH's e-claims and transactions framework, which covers claim submission, remittance advice, prior requests and authorizations and electronic prescriptions. A frequent mistake is to treat Malaffi as a claims system. It is not. Malaffi carries clinical records, and Shafafiya carries claims. Read more in our Malaffi integration guide.

Abu Dhabi also expects facilities to meet ADHICS, the DOH's healthcare information and cyber security standard. Malaffi's own onboarding includes a security assessment drawn from ADHICS, so security work and HIE work run together.

Northern Emirates: MOHAP and Riayati

Riayati is MOHAP's National Unified Medical Record. It serves facilities licensed by MOHAP in Sharjah, Ajman, Ras Al Khaimah, Fujairah and Umm Al Quwain, and it is linked with NABIDH and Malaffi so records can move between emirates. MOHAP describes it as connecting thousands of public and private facilities, from hospitals to clinics and diagnostic centers.

For a Northern Emirates clinic, the practical point is the same as in Dubai or Abu Dhabi: the EMR you choose must be able to send the data Riayati expects, and the connection should be part of your licensing plan from day one.

What every UAE clinic system needs, whatever the emirate

• Emirates ID capture. The national ID is central to patient matching across all three exchanges. Reading it from the card avoids typing errors that break matching later.
• Structured, coded data. Diagnoses in ICD-10, procedures and services in the code sets your regulator and payers expect, and clinician licence numbers on each billed activity.
• HL7 messaging (and increasingly FHIR) to the relevant exchange, with a way to see what was sent and what failed.
• E-claims built from the chart, so the codes on the claim match what the doctor documented.
• Data kept in the UAE. Federal Law No. 2 of 2019 restricts storing or processing UAE health data outside the country except where permitted. See our guide to UAE health data law.
• Audit trails and role-based access, because every regulator expects you to know who saw and changed what.

Expanding to a second emirate: a checklist

1. Confirm which authority will license the new branch (DHA, DOH, MOHAP, or a free-zone regulator such as DHCC's).
2. List the exchange and e-claims platform that authority requires, and the onboarding lead time each one needs.
3. Check that your EMR vendor already runs live on that exchange, not just on paper. Ask for the message types they send.
4. Plan the payer side: which insurers and TPAs you will bill, and through which platform.
5. Review data residency and security obligations (for Abu Dhabi, include ADHICS early).
6. Set up branch-level settings: licence numbers, facility IDs and credentials are usually per facility, not per group.
7. Train front-desk staff on ID capture and consent for the new emirate before go-live.

Groups that run branches in more than one emirate feel this most. A multi-branch clinic system that keeps one patient record and one ledger, while sending each branch's data to the right regulator, saves a lot of reconciliation work.

Four mistakes we see when clinics plan UAE IT

• Treating the exchange as a later project. NABIDH, Malaffi and Riayati are tied to licensing. Leaving them until after opening risks a delayed licence or renewal.
• Confusing the clinical and claims rails. The exchange carries records, the e-claims platform carries money. They have different owners in your team and different failure modes.
• Assuming one set of credentials covers the group. Facility IDs, licences and gateway credentials are usually set per branch. A group-level login does not replace them.
• Buying on the word 'certified'. Ask which facilities are live on each exchange today, which message types the vendor sends and who monitors failures.

Where Helix fits

Helix was built in Dubai by doctors who have worked under these rules. It is connected to NABIDH in Dubai and Malaffi in Abu Dhabi, integrated with Riayati for the Northern Emirates, and integrated with eClaimLink/DHPO and Shafafiya for claims. The same patient record feeds the specialty EMR, the invoice and the claim, so there is no re-typing between systems. You can see the full, honest list on our integrations page.